结束已知应用程序名的进程

从CSDN好友博客上挖掘的知识，自己学习兼测试了下，笔记于下：

vs2005，unicode环境下

#include <Tlhelp32.h> #include <stdio.h> void KillProcess(LPTSTR sProcessName) { TCHAR cTemp[256]; //判该程序是否运行 HANDLE hProcessSnap = NULL; PROCESSENTRY32 pe32={0}; PROCESS_INFORMATION ProcessInfo; STARTUPINFO StartupInfo = {0}; hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hProcessSnap == (HANDLE)-1) return; pe32.dwSize = sizeof(PROCESSENTRY32); if (Process32First(hProcessSnap, &pe32)) { do { if (_tcscmp(pe32.szExeFile,sProcessName) == 0) { StartupInfo.cb = sizeof(STARTUPINFO); StartupInfo.wShowWindow = SW_HIDE; ZeroMemory(&StartupInfo, sizeof(StartupInfo)); _stprintf(cTemp,_T("ntsd -c q -p %d"), pe32.th32ProcessID); CreateProcess(NULL,cTemp,NULL,NULL,FALSE,0,NULL,NULL,&StartupInfo,&ProcessInfo); CloseHandle(hProcessSnap); return ; } }while (Process32Next(hProcessSnap, &pe32)); } CloseHandle(hProcessSnap); }

假设已知应用程序全路径名称：

 LPTSTR lpszProcName = _T("C://Documents and Settings//Administrator//桌面//release//AndroidSuite.exe")

那么如下调用即可杀死已有进程。
 LPTSTR lpExeName = _tcsrchr(lpszProcName, '//');
 KillProcess(lpExeName + 1);
当然也可直接用KillProcess(_T("BeatTest.exe"));

随时写了个示例Demo：

 

按下结束当前进程按钮，360会提示木马，

 

=====》Demo源代码